내장 함수

# Block any method containing "sign"
deny if {
    contains(input.rpc_method, "sign")
}

# Block debug methods
deny if {
    startswith(input.rpc_method, "debug_")
}
 
# Block addresses starting with many zeros
deny if {
    startswith(input.to_address, "0x00000000")
}

# Block addresses ending with specific pattern
deny if {
    endswith(lower(input.to_address), "dead")
}

# Case-insensitive address check
blocked_addresses := {
    "0x000000000000000000000000000000000000dead"
}
 
deny if {
    lower(input.to_address) in blocked_addresses
}

# Normalize method names that might have inconsistent casing
deny if {
    upper(input.rpc_method) == "ETH_SENDTRANSACTION"
    input.usd_value > 10000
}

# Join values for logging or comparison
message := concat(", ", ["chain:", input.chain, "method:", input.rpc_method])

# Parse a method name
parts := split(input.rpc_method, "_")
 
deny if {
    parts[0] == "debug"
}

# Normalize address format
normalized := replace(input.to_address, "0X", "0x")

# Get method prefix (first 4 characters after "eth_")
deny if {
    startswith(input.rpc_method, "eth_")
    method_action := substring(input.rpc_method, 4, 4)
    method_action == "send"
}

# Create formatted message
threshold := 10000
message := sprintf("Value %d exceeds limit of %d", [input.usd_value, threshold])

# Remove specific characters from both ends
cleaned := trim(input.rpc_method, "_")

# Clean up input with extra spaces
clean_method := trim_space(input.rpc_method)

# Remove common prefix to get the action name
method_name := trim_prefix(input.rpc_method, "eth_")
 
deny if {
    method_name == "sendTransaction"
}

# Remove suffix for comparison
base_method := trim_suffix(input.rpc_method, "_v2")

# Check if underscore exists
deny if {
    indexof(input.rpc_method, "_") == -1
}

# Block methods starting with debug_, admin_, or personal_
deny if {
    regex.match("^(debug_|admin_|personal_)", input.rpc_method)
}
 
# Block addresses with many leading zeros
deny if {
    regex.match("^0x0{10,}", input.to_address)
}

# Remove all non-alphanumeric characters
cleaned := regex.replace(input.rpc_method, "[^a-zA-Z0-9]", "")

# Split by multiple delimiters
parts := regex.split("[_.]", input.rpc_method)

# Find all hex sequences
hex_matches := regex.find_n("0x[a-fA-F0-9]+", input.raw_params[0].data, 10)
 
deny if {
    count(hex_matches) > 5
}

# Block high-value transactions during volatile market hours
deny if {
    current := time.now_ns()
    [hour, _, _] := time.clock(current)
    hour >= 14  # After 2 PM UTC (US market open)
    hour < 21   # Before 9 PM UTC (US market close)
    input.usd_value > 50000
}

# Block outside business hours (9 AM - 5 PM UTC)
deny if {
    [hour, _, _] := time.clock(time.now_ns())
    hour < 9
}
 
deny if {
    [hour, _, _] := time.clock(time.now_ns())
    hour >= 17
}

# Block on weekends
deny if {
    day := time.weekday(time.now_ns())
    day == 0  # Sunday
}
 
deny if {
    day := time.weekday(time.now_ns())
    day == 6  # Saturday
}

# Block on specific dates
deny if {
    [year, month, day] := time.date(time.now_ns())
    month == 12
    day == 25  # Christmas
}

# Compare against a specific date
cutoff := time.parse_rfc3339_ns("2024-12-31T23:59:59Z")
 
deny if {
    time.now_ns() > cutoff
}

# Block transactions if we're within 7 days of year end
deny if {
    year_end := time.parse_rfc3339_ns("2024-12-31T23:59:59Z")
    week_before := time.add_date(year_end, 0, 0, -7)
    time.now_ns() > week_before
    input.usd_value > 10000
}

# Check if more than 1 hour has passed
start := time.parse_rfc3339_ns("2024-01-01T00:00:00Z")
[_, _, _, hours, _, _] := time.diff(time.now_ns(), start)
 
deny if {
    hours > 1
}

# Limit number of contracts in a request
deny if {
    count(input.contract_addresses) > 5
}
 
# Ensure at least one address
deny if {
    count(input.contract_addresses) == 0
}

# Block if total gas across params exceeds limit
deny if {
    gas_values := [to_number(p.gas) | some p in input.raw_params; p.gas != null]
    sum(gas_values) > 5000000
}

# Check against maximum in a set of thresholds
thresholds := [1000, 5000, 10000]
 
deny if {
    input.usd_value > max(thresholds)
}

# Ensure value meets minimum threshold
thresholds := [100, 500, 1000]
 
deny if {
    input.usd_value < min(thresholds)
}

# Check if smallest contract address looks suspicious (many leading zeros)
deny if {
    count(input.contract_addresses) > 0
    sorted_addrs := sort(input.contract_addresses)
    startswith(sorted_addrs[0], "0x00000000")
}

# Calculate combined risk score from multiple factors
deny if {
    risk_factors := [2, 3]  # High-value = 2x, Unknown sender = 3x
    combined_risk := product(risk_factors)
    combined_risk > 5
}

# Safely check nullable field
deny if {
    not is_null(input.usd_value)
    input.usd_value > 10000
}

# Validate before numeric comparison
deny if {
    is_number(input.usd_value)
    input.usd_value > 10000
}

# Validate input type
deny if {
    is_string(input.to_address)
    startswith(input.to_address, "0x0000")
}

# Check before iterating
deny if {
    is_array(input.contract_addresses)
    count(input.contract_addresses) > 10
}

# Verify a flag is actually a boolean before using it
deny if {
    is_boolean(input.raw_params[0].enabled)
    input.raw_params[0].enabled == false
}

# Validate collection type
deny if {
    is_set(input.raw_params[0].addresses)
    count(input.raw_params[0].addresses) > 100
}

# Ensure params is an object before accessing fields
deny if {
    is_object(input.raw_params[0])
    object.get(input.raw_params[0], "dangerous", false) == true
}

# Block if usd_value is not a number (unexpected type)
deny if {
    input.usd_value != null
    type_name(input.usd_value) != "number"
}

# Check magnitude regardless of sign
deny if {
    abs(input.usd_value) > 10000
}

# Round for comparison
deny if {
    round(input.usd_value) > 10000
}

# Round up for conservative limit checking
deny if {
    ceil(input.usd_value) > 10000
}

# Block transactions over $10,000 (ignoring cents)
deny if {
    floor(input.usd_value) >= 10000
}

# Convert hex gas values
deny if {
    input.gas_limit != null
    to_number(input.gas_limit) > 1000000
}

# Allow transactions only during business hours (9 AM - 5 PM)
deny if {
    [hour, _, _] := time.clock(time.now_ns())
    business_hours := numbers.range(9, 17)
    not hour in business_hours
}

# Safely access nested data
deny if {
    params := input.raw_params[0]
    data := object.get(params, "data", "0x")
    startswith(data, "0xa9059cbb")  # ERC-20 transfer
}

# Check which fields are present
params := input.raw_params[0]
keys := object.keys(params)
 
deny if {
    "data" in keys
    "value" in keys
}

# Block if params contain unexpected fields after removing known safe ones
deny if {
    safe_fields := ["to", "from", "value", "gas", "data"]
    remaining := object.remove(input.raw_params[0], safe_fields)
    count(object.keys(remaining)) > 0
}

# Apply safe defaults and check resulting gas limit
deny if {
    defaults := {"gas": "0x5208"}
    params := object.union(defaults, input.raw_params[0])
    to_number(params.gas) > 1000000
}

# Combine address lists
all_addresses := array.concat(
    input.contract_addresses,
    [input.to_address]
)

# Only check first 5 contract addresses for blocked list
deny if {
    first_five := array.slice(input.contract_addresses, 0, 5)
    some addr in first_five
    addr in {"0xbanned1...", "0xbanned2..."}
}

# Check last contract address (most recent) for suspicious patterns
deny if {
    count(input.contract_addresses) > 0
    reversed := array.reverse(input.contract_addresses)
    startswith(reversed[0], "0x00000000")
}

# Check for any blocked address
blocked := {"0xdead...", "0xbad..."}
request_addrs := {lower(input.to_address)}
 
deny if {
    count(intersection(blocked, request_addrs)) > 0
}

# Combine multiple blocklists
blocked_countries := union(
    {"KP", "IR", "CU"},
    {"SY", "RU"}
)
 
deny if {
    input.source_country in blocked_countries
}

# Check if method matches an encoded pattern
deny if {
    encoded_method := base64.encode(input.rpc_method)
    encoded_method == "ZXRoX3NlbmRUcmFuc2FjdGlvbg=="  # eth_sendTransaction
}

# Decode base64 data from request
decoded := base64.decode("aGVsbG8=")  # "hello"
 
deny if {
    contains(decoded, "dangerous")
}

# Create URL-safe identifier from address for comparison
deny if {
    encoded_addr := base64url.encode(input.to_address)
    encoded_addr in {"MHhkZWFk...", "MHhiYWQ..."}
}

# Decode and check URL-safe encoded data in params
deny if {
    encoded_data := object.get(input.raw_params[0], "encoded", "")
    decoded := base64url.decode(encoded_data)
    contains(decoded, "malicious")
}

# Encode method name to hex for pattern matching
deny if {
    method_hex := hex.encode(input.rpc_method)
    startswith(method_hex, "657468")  # "eth" in hex
}

# Decode hex-encoded data field and check contents
deny if {
    data := object.get(input.raw_params[0], "data", "")
    startswith(data, "0x")
    decoded := hex.decode(substring(data, 2, 8))
    contains(decoded, "admin")
}